fix(flake): make Hetzner the canonical cc-ci host target

README.md

@@ -14,8 +14,9 @@ per-recipe test trees, and the docs to enroll a recipe or rebuild the box from s
 ## Layout
 
 ```
-flake.nix              NixOS entry point + devshells (stays at root; build ref #cc-ci)
-nix/hosts/cc-ci/       the cc-ci machine config
+flake.nix              NixOS entry point + devshells (`#cc-ci` = live Hetzner host, `#cc-ci-incus` = legacy Incus host)
+nix/hosts/cc-ci/       legacy Incus VM host config (fallback / historical)
+nix/hosts/cc-ci-hetzner/ live Hetzner host config
 nix/modules/           drone, comment-bridge, swarm, dashboard, secrets (Nix modules)
 secrets/               sops-encrypted infra secrets (cc-ci-secrets submodule)
 bridge/                !testme webhook listener source
@@ -25,8 +26,11 @@ tests/<recipe>/        per-recipe install/upgrade/backup tests + playwright/
 docs/                  install, enroll-recipe, secrets, architecture, runbook, baseline
 ```
 
-All `.nix` code lives under `nix/`; `flake.nix`/`flake.lock` stay at the repo root so the build
-reference (`nixos-rebuild switch --flake '…#cc-ci'`) is unchanged.
+All `.nix` code lives under `nix/`; `flake.nix`/`flake.lock` stay at the repo root. Host targets are:
+
+- `#cc-ci` = canonical live Hetzner server
+- `#cc-ci-hetzner` = explicit alias for the same live Hetzner server
+- `#cc-ci-incus` = legacy Incus VM definition only; do not use on Hetzner
 
 ## Docs